CStone Pharmaceuticals — Audit Report / Information 2022

Jun 30, 2022

Hong Kong Exchanges and Clearing Limited and The Stock Exchange of Hong Kong Limited take no responsibility for the contents of this announcement, make no representation as to its accuracy or completeness and expressly disclaim any liability whatsoever for any loss howsoever arising from or in reliance upon the whole or any part of the contents of this announcement.

==> picture [116 x 36] intentionally omitted <==

CStone Pharmaceuticals 基石藥業

(Incorporated in the Cayman Islands with limited liability)

(Stock Code: 2616)

(1) LATEST STATUS OF REMEDIAL ACTIONS; AND (2) COMPLETION OF INTERNAL CONTROL REVIEW

This announcement is made by the board (the “ Board ”) of directors (the “ Directors ”) of CStone Pharmaceuticals (the “ Company ”, together with its subsidiaries, the “ Group ”) on a voluntary basis to inform the shareholders and potential investors of the Company about the latest status of Remedial Actions (as defined below) and completion of internal control review.

Reference is made to the announcement of the Company dated May 31, 2022, in relation to, among others, the key findings of independent investigation and remedial actions (the “ Announcement ”). Unless otherwise defined, capitalised terms used in this announcement shall have the same meanings as those defined in the Announcement.

(1) LATEST STATUS OF REMEDIAL ACTIONS

As disclosed in the Announcement, the Company would take several remedial actions (the “ Remedial Actions ”) by the proposed timeline to prevent similar cases from occurring in the future. The Board is pleased to announce that the Remedial Actions have been implemented according to the proposed timeline, and the detailed status of the Remedial Actions up to the date of this announcement are set forth below:

No.	Remedial Actions	Status
(i)	to pursue an early redemption of the Investment by giving instructions to CMBI by May31,2022;	On May31,2022, the Company has instructed CMBI to proceed with an early redemption of the Investment. As of the date of this announcement, CMBI is still processing the early redemption request of the Investment. The Company will closely monitor the progress of the redemption of the Investment. The Company expects that the redemption of the substantial portion of the Investment will be completed by the end of2022.

1

No.	Remedial Actions	Status
(ii)	to instruct the Group’s management to review the2021Annual Results and material transactions, and report to the Board of their review results by May30, 2022;	T h e G r o u p ’ s m a n a g e m e n t ( t h e “Management”) has completed the review and reported the review results to the Board on May30,2022, in which the auditors of the Company has issued an unqualified audit opinion on the2021Annual Results. Save for the Investment as disclosed in the Announcement, the Company is not aware of any material transaction which involves non-compliance of the applicable requirements under the Listing Rules. The2021Annual Results was published by the Company on May31,2022.
(iii)	to enhance the Company’s investment policy and procedure (the “Investment Management Policy”) according to the Company’s investment strategy and risk appetite by June30,2022;	The Company has adopted on June29, 2022, the enhanced Investment Management Policy for regulation of the Group’s investment activities, which clearly sets out the role of the Investment Committee in managing the Group’s investment matters which effectively achieve segregation of duties between investment decision- making by the Investment Committee and execution of proposed investment by the finance department of the Company and the specific measures for enhancement of risk management on investments, which include among others, (i) safety and preservation of the principal amount of investment through minimization of default risk and market risk, (ii) re-emphasis on prohibition of investment in any derivative securities and (iii) performance of investment due diligence on the issuer and financial intermediaries (if applicable) of the relevant investment products.

2

No.	Remedial Actions	Status
(iv)	to require well-maintained documentation, including supporting documents for investments by June30,2022;	The document retention requirements have been incorporated in all the investment- related internal control policies of the Company including but not limited to the Investment Management Policy, the Bank Account Management Policy and the Payment Management Policy of the Company, which have been adopted on June 29,2022. An investment register shall be maintained by the finance department of the Company, with status update on the financial performance and key operation highlights of the investments to be prepared by the Vice President of Finance and submitted to the Investment Committee for review on a monthly basis. In addition, key documents in relation t o i n v e s t m e n t s , i n c l u d i n g b u t n o t limited to unrestricted cash forecasts, investment plans, due diligence results, decision-making and approval records, transaction documents such as contracts, invoices, bank payment slips and security notes, etc., monthly status update materials, records and reports of all the meetings of the Investment Committee, shall be properly archived by the finance department of the Company.

3

No.	Remedial Actions	Status
(v)	to re-emphasise to the finance staff and Company management as to the application of the Company’s investment policy by May31,2022;	A preliminary training has been provided to the finance staff and Company management on May31,2022to re-emphasise the application of the Company’s investment policy, with the enhanced Investment Management Policy being circulated to the finance department of the Company and the Accounting and Finance Trainings being held on June28,2022, respectively.
(vi)	to lower the signing authority threshold for external payments from USD50million to USD3million by May31,2022;	Such measure has been fully implemented with effect from May31,2022and incorporated in (i) the Payment Management Policy which sets forth the payment application and approval procedures, cash management principles and corresponding responsibilities of designated approvers and (ii) the Standard Operating Procedures for Contract Request, Approval and Management which set forth the contract request, approval and management procedures.
(vii)	to review and enhance internal control around investment and payment policies and procedures with sufficient segregation of duties and checks and balance by June 30,2022, including but not limited to the implementation and enhancement of the Bank Account Management Policy, Investment Management Policy and payment Management Policy and requires all Directors, senior management and accounting and finance personnel to strictly adhere to these policies;	The Company has enhanced the Investment Management Policy, Bank Account M a n a g e m e n t P o l i c y a n d P a y m e n t Management Policy, which applies to all Directors, senior management and accounting and finance personnel, and being adopted on June29,2022.

4

No.	Remedial Actions	Status
(viii)	to review and enhance internal control over the employee exit procedure by June30, 2022;	The employee exit procedure has been reviewed and enhanced by the Company’s human resources department in June2022, pursuant to which (i) an employee exit clearance procedure has been established for key personnel of the Company, (ii) data back-up and document retention requirements have been strengthened for all employees to be departed from the Company and (iii) the employee exit checklist has been further updated and fine- tuned for all employees to be departed from the Company in terms of requirements on hand-over materials and exit interview. The Internal Control Consultant (as defined below) has also reviewed and the Company has taken remedial actions in respect of user account and data backup management for enhancing IT controls. For details, please refer to the “management proposed remedial actions taken by the Company to address the findings” under the section entitled “B. SUMMARY OF THE FINDINGS FROM THE INTERNAL CONTROL REVIEW” in this announcement.
(ix)	to provide trainings to senior management and the accounting and finance personnel of the Group by June30,2022, in particular, on further strengthening internal financial and accounting policies, preparation of comprehensive accounting memo to support the accounting basis for complex or significant transactions (the “Accounting and Finance Trainings”);	The Accounting and Finance Trainings have been provided by the Vice President of Finance to the senior management and finance department of the Company on June 28,2022.

5

No.	Remedial Actions	Status
(x)	to adopt and circulate a detailed guideline relating to notifiable and connected transactions under the Listing Rules (the “Notifiable and Connected Transactions Guidelines”) and arrange trainings to be provided by its legal advisors to the Directors, senior management and accounting and finance personnel by June30,2022and on regular basis, on the Listing Rules, particularly in relation to the subscription of different types of financial products aiming to strengthen their understanding to identify the circumstances which are expected to trigger the announcement requirement under the Listing Rules and potential issues at an early stage to avoid the recurrence of delay in disclosure for future subscriptions of financial products should such obligations arise (the “Notifiable and Connected Transactions Trainings”);	The Notifiable and Connected Transactions Guidelines have been adopted by the Company and circulated to the Board and all relevant personnel of the Group including but not limited to the business team, the company secretary, the finance department and the legal department of the Company on June29,2022. The legal advisers of the Company have provided the Notifiable and Connected Transactions Trainings to the Directors on May31,2022and to the senior management and the finance department of the Company on June28,2022, and are expected to provide annual training sessions to reinforce their knowledge on notifiable and connected transactions.
(xi)	with immediate effect, prior to entering into any relevant potential transaction in the future, to perform size test analysis by the accounting and finance personnel in consultation with the legal department and external counsel to ensure compliance with the Listing Rules;	Such measure has been fully implemented with effect from May31,2022and incorporated in the Notifiable and Connected Transactions Guidelines.
(xii)	with immediate effect, to strengthen the coordination and reporting arrangements for notifiable transactions and connected transactions among its subsidiaries;	Such measure has been fully implemented with effect from May31,2022and incorporated in the Notifiable and Connected Transactions Guidelines.
(xiii)	to enhance regular reconciliation process for major accounts including bank balances, money market funds and other investments (the “Bank Reconciliation”) commencing from May31,2022, which shall be reviewed by the Vice President of Finance to ensure accuracy and completeness, with all outstanding items to be clearly explained and promptly investigated to ensure the bank deposit safety and balance accuracy, and include the Bank Reconciliation in the Company’s management accounts to be submitted to the Board for consideration on a regular basis;	The Bank Reconciliation and related measures have been fully implemented commencing from May31,2022and incorporated in the Bank Account Management Policy which specifies among others, the daily operational procedures for opening, cancellation and modification of bank account, as well as detailed requirements on access right and payment authorization.

6

No.	Remedial Actions	Status
(xiv)	to further strengthen the implementation of dual approval control for bank transfer payments via the online banking platform by May31,2022; and	The dual approval control has been fully implemented commencing from May31, 2022on the Company and subsidiary’s level, in which (i) password protected tokens are properly managed by authorized individuals only and (ii) before proceeding with any payment transactions of over USD3million via online banking platform, approval from the Investment Committee must be obtained. The above measures have been incorporated in the Bank Account Management Policy.
(xv)	to seek external legal or other professional advice on remedies on economic loss of the Investment and any proposed material transactions and corporate actions in the future.	The Company has sought legal advice on remedies on the economic loss of the Investment. Based on the facts of the incident available to the Company and the nature of the Investment, given that CMBI is still processing the early redemption request of the Investment, the Company understood that the chance for recovery of the loss of the Investment is remote. The Company will continue to pay attention to this matter. The Company will consult its legal advisers, compliance advisers and engage other external advisers in the event that there is any proposed material transactions and corporate actions.

The Board and the Audit Committee have reviewed the status of the Remedial Actions and consider that (i) the Remedial Actions are adequate and sufficient to address the internal control weaknesses identified by the Independent Advisor; and (ii) the Remedial Actions have been fully implemented according to the proposed timeline.

(2) COMPLETION OF INTERNAL CONTROL REVIEW

The Company has engaged PricewaterhouseCoopers Business Consulting (Shanghai) Limited as an external internal control consultant (the “ Internal Control Consultant ”) to conduct an independent internal control review over the selected processes as listed in Section A below and to report factual findings identified by the Internal Control Consultant in respect of the scopedin processes (the “ Internal Control Review ”), which are determined by the Company based on the major internal control weakness and scope of limitation identified in the Investigation and the prioritized issues on top of the Remedial Actions, with an aim to examine the level and status of overall performance of existing internal controls of the Company for the selected processes. The Internal Control Review Report was issued on June 29, 2022. A summary of the findings from the Internal Control Review Report and the remedial actions taken by the Company is set out below.

7

A. SCOPE OF THE INTERNAL CONTROL REVIEW

Review Period: January 1, 2021 - May 31, 2022

The scope of the Internal Control Review was limited to the following three areas:

Area	Sub-Area
Entity-level Control (“ELC”)	• Control environment • Risk assessment • Control activities • Information and communication • Monitoring activities
Procurement to Payment (“PTP”)	• Procurement planning • Purchase requisition • Vendor management (sourcing/selection/ evaluation/master data management) • Contract establishment • Purchase order (“PO”) management • Goods and service receipt • Payment verification (three-way matching)
Information Technology (“IT”) Controls	IT General Controls (“ITGC”) over the Systems Applications and Products (“SAP”) system • IT environment • Program development • Program change • Access to program data • Computer/system operation Other IT Controls • User access control and data backup rules over Outlook and share folders

8

B. SUMMARY OF THE FINDINGS FROM THE INTERNAL CONTROL REVIEW

No.	Area	Finding Titles from the Internal Control Review Report	Management proposed remedial actions taken by the Company to address the findings	Management assessment of implementation status
–	ELC	One ELC finding is identified. Please refer to no.4for details
1	PTP	Insufficient controls to ensure that contract value is within the approved sourcing request value	The Company has formally established appropriate procedures to ensure that a sourcing request shall be revised and re-approved by delegated personnel if the actual purchase value exceeds the approved sourcing request value.	Remediated
2	PTP	Lack of periodic review of open POs	A mechanism of bi-annual reviews and follow up on open purchase orders has been implemented since June2022, and the Company is now checking the reasons for existing long-aging open purchase orders.	Remediated
3	PTP	Lack of independent review of the catalogue price list master data change log	A mechanism of independent bi- annual reviews of the catalogue price list master change log has been implemented.	Remediated
4	ELC/IT Controls	IT policies are not established in certain areas: • Program development/program change • Regular review of system log • Data backup of the Company’s systems and key staff’s personal computers (“PC”) • Monitoring and evaluating of IT suppliers	Relevant IT policies have been refined or established to cover the areas mentioned in the finding.	Remediated
5	IT Controls	Insufficient management of SAP privileged accounts and activities: • Privileged accounts are granted to IT suppliers at the application and database levels of the SAP system • The audit logs in the SAP database and operating system are not enabled	The audit logs in the SAP database and operating system have been enabled, and a strict and bi-annual reviews of the logs of those privileged accounts will be performed.	Remediated

9

No.	Area	Finding Titles from the Internal Control Review Report	Management proposed remedial actions taken by the Company to address the findings	Management assessment of implementation status
6	IT Controls	Insufficient document retention for approval records of changes of SAP program and user accounts/permissions	The Company will properly retain all SAP related approval records.	Remediated
7	IT Controls	Lack of periodic review of system user accounts: • Redundant application accounts exist in the SAP system • Periodic review of system access rights and user accounts is not performed for SAP, Outlook and share folder	The redundant user accounts will be locked in a timely manner, and bi- annual reviews of system access rights and user accounts will be performed.	Remediated
8	IT Controls	Insufficient data backup management: • Data backup of Outlook and key staff’s PC is not performed • Periodic testing on recoverability of the data backup of the SAP system and share folder is not performed	Backup strategy has been defined and setup for Outlook and key staff’s PCs, and backup recovery testing will be performed on a bi-annual basis.	Remediated
9	IT Controls	Lack of segregation of duties in the IT management over the SAP system: • Administrators in the application, database, and operating levels are not separated • Owners of program change development, testing, and launching are not separated	System administrators in the application, database, and operating levels, and owners of program change development, testing, and launching have been segregated.	Remediated
10	IT Controls	Insufficient password rules for the SAP system	Password rules in the SAP application, database and operating levels have been strengthened in the system setting to meet the requirement of the Company’s password policy.	Remediated

10

C. OVERALL RESPONSE OF THE BOARD AND AUDIT COMMITTEE

The Board and the Audit Committee have reviewed the Internal Control Review Report prepared by the Internal Control Consultant and consider that (i) the Internal Control Review has assessed the effectiveness of the internal controls of the Company for the selected processes and identified certain internal control deficiencies; (ii) the identified internal control deficiencies have been remediated; and (iii) the remedial actions and improvement measures implemented by the Company are adequate and sufficient to address the identified internal control deficiencies.

By order of the Board CStone Pharmaceuticals Dr. Wei Li Chairman

Suzhou, the People’s Republic of China, June 30, 2022

As at the date of this announcement, the board of directors of the Company comprises Dr. Wei Li as Chairman and non-executive director, Dr. Frank Ningjun Jiang as executive director, Mr. Kenneth Walton Hitchner III, Mr. Yanling Cao, Mr. Xianghong Lin and Mr. Edward Hu as non-executive directors, and Dr. Paul Herbert Chew, Mr. Ting Yuk Anthony Wu and Mr. Hongbin Sun as independent non-executive directors.

11